# Handling first installation

**URL:** <https://community.developer.atlassian.com/t/handling-first-installation/29652>\
**Category:** Jira Cloud\
**Created:** [June 3, 2019, 8:56am UTC](https://community.developer.atlassian.com/t/handling-first-installation/29652 "2019-06-03T08:56:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![olo](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/olo/32/38017_2.png) [@olo](https://community.developer.atlassian.com/u/olo)\
**Post date:** [June 3, 2019, 8:56am UTC](https://community.developer.atlassian.com/t/handling-first-installation/29652/1 "2019-06-03T08:56:21Z")

</div>

Hi,  
as documentation says on first installation Jira would not send any JWT tokens for costumer. How my app supposed to act in this scenario? Why is first install callback request empty?

---

<div class="post-metadata">

**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\
**Post date:** [June 3, 2019, 9:11am UTC](https://community.developer.atlassian.com/t/handling-first-installation/29652/2 "2019-06-03T09:11:36Z")

</div>

Can you elaborate a bit on what you mean with “first install”? Do you mean the [Installation handshake](https://developer.atlassian.com/cloud/jira/platform/authentication-for-apps/)?

It would help if you would post a link to the documentation you’re referring to, this will help us give you a good explanation.

---

<div class="post-metadata">

**Author:** ![olo](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/olo/32/38017_2.png) [@olo](https://community.developer.atlassian.com/u/olo)\
**Post date:** [June 3, 2019, 10:17am UTC](https://community.developer.atlassian.com/t/handling-first-installation/29652/3 "2019-06-03T10:17:53Z")

</div>

I’m refering to this doc page:  
[https://developer.atlassian.com/cloud/jira/software/authentication-for-apps/](https://developer.atlassian.com/cloud/jira/software/authentication-for-apps/)

There is a table with some scenarios, and one of them is on first installation:

> None; no JWT token. Because there was no previous shared secret the recipient cannot validate a JWT token. This means that you should anticipate that there will be no `Authorization` header present.

I tested this behavior again and found out that they steel send secret key, so that means that i only cant verify response from Jira.

---

<div class="post-metadata">

**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\
**Post date:** [June 3, 2019, 10:36am UTC](https://community.developer.atlassian.com/t/handling-first-installation/29652/4 "2019-06-03T10:36:57Z")

</div>

If you want to verify the payload, you can actually do a request to the Jira Cloud instance using the client ID and shared secret to generate a JWT token. If you are able to successfully connect, you will know the payload is valid.